Subprocessors
Last Updated: 2026-06-30
A subprocessor is any third-party service Shine engages that may process personal data on our behalf in order to deliver the Services. We list every active subprocessor here so you can review who handles your data and where it is processed.
Where a subprocessor is located outside the European Economic Area, United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, the Swiss-equivalent mechanism, and, where applicable, supplementary measures to safeguard the transfer in line with GDPR Chapter V. This statement mirrors our Privacy Policy.
Infrastructure
Hosting, storage, and database services that hold the Shine platform.
Amazon Web Services (AWS)
- Purpose
- Application hosting, object storage (S3), and managed database (RDS). All customer recordings and database records live on AWS.
- Location
- United States
- Data categories
- All customer content, including interview recordings, transcripts, and account data.
Vercel
- Purpose
- Static hosting and edge delivery for the shine.studio marketing site.
- Location
- United States
- Data categories
- No customer content. IP addresses and request metadata for the marketing site.
Cloudflare
- Purpose
- CDN, DNS, and bot protection (Turnstile) for the marketing site.
- Location
- Global edge network
- Data categories
- IP addresses and request metadata.
Supabase
- Purpose
- Interview-capture database, authentication, and serverless functions for the interview-recording surface.
- Location
- United States
- Data categories
- Interview recordings (at the point of capture), respondent identifiers, and session metadata.
Video & Media
Services that host, encode, and render recorded interview media.
Mux
- Purpose
- Video hosting, encoding, and delivery for interview recordings.
- Location
- United States
- Data categories
- Interview video files and derived stream metadata.
Shotstack
- Purpose
- Server-side video rendering for clip and asset generation.
- Location
- Australia
- Data categories
- Interview clips and rendering job metadata.
AI & Transcription
AI providers used strictly as data processors. Customer content is NOT used to train these providers’ general-purpose models — opt-out flags are set on every customer-data API call (see internal audit).
Deepgram
- Purpose
- Speech-to-text transcription of interview recordings.
- Location
- United States
- Data categories
- Interview audio and resulting transcripts.
OpenAI
- Purpose
- AI claim extraction, summarization, and quote generation.
- Location
- United States
- Data categories
- Interview transcripts and derived text snippets.
Anthropic
- Purpose
- AI claim extraction, summarization, and quote generation.
- Location
- United States
- Data categories
- Interview transcripts and derived text snippets.
Google (Gemini)
- Purpose
- AI claim extraction, summarization, and asset enhancement.
- Location
- United States
- Data categories
- Interview transcripts and derived text snippets.
Perplexity
- Purpose
- AI-visibility (GEO) auditing — queries how AI answer engines describe a customer brand. Opt-in, per workspace.
- Location
- United States
- Data categories
- Brand and topic query prompts. No interview content or respondent personal data.
ElevenLabs
- Purpose
- AI voice generation for narrated assets.
- Location
- United States
- Data categories
- Generated audio output (no customer audio uploaded).
Payments
Payment processing and payout services.
Stripe
- Purpose
- Subscription billing and customer payment processing.
- Location
- United States
- Data categories
- Billing email, payment method tokens, and subscription state. Shine never stores raw card numbers.
Tremendous
- Purpose
- Gift-card and reward payouts to interview respondents who complete a session.
- Location
- United States
- Data categories
- Respondent name, email address, and payout status.
Communications
Transactional email and notification delivery.
Google Workspace (Sheets)
- Purpose
- Operational mirror of marketing-site contact submissions (waitlist, quote requests) for the sales team.
- Location
- United States
- Data categories
- Marketing-contact details: name, email, company, and message content submitted via site forms.
Resend
- Purpose
- Transactional email delivery (invitations, magic links, receipts).
- Location
- United States
- Data categories
- Recipient email addresses and email content.
Analytics & Product Telemetry
Used to understand how the Services are used in aggregate. Subject to your cookie preferences — see our Cookie Policy.
Google Analytics 4
- Purpose
- Marketing-site visitor analytics.
- Location
- United States
- Data categories
- IP-derived geography, page views, referrer, and aggregated session metrics.
Microsoft Clarity
- Purpose
- Session replay and heatmap analytics for the marketing site.
- Location
- United States
- Data categories
- Anonymized session recordings and click maps.
PostHog
- Purpose
- Product analytics and error tracking inside the Shine application.
- Location
- United States
- Data categories
- Authenticated user identifiers, product event metadata, and exception traces.
Identity
Authentication infrastructure.
Keycloak
- Purpose
- Self-hosted identity provider for the Shine application. Operated by Shine on AWS — not a third-party processor in the conventional sense, but listed for transparency.
- Location
- United States (deployed on AWS)
- Data categories
- Account credentials and session state.
Stay informed of changes
We notify customers in advance of any material change to this list — typically at least 30 days before a new subprocessor begins processing personal data. To subscribe to notifications, email hello@shine.studio with the subject "Subprocessor Notifications."
Customers may object to a new subprocessor on reasonable grounds. If we cannot accommodate the objection, you have the right to terminate the affected Services in accordance with your Data Processing Agreement.
Data Processing Agreement
Customers may request our Data Processing Agreement (DPA), which incorporates the applicable Standard Contractual Clauses, at any time by emailing hello@shine.studio.
See also: Privacy Policy · Cookie Policy · Terms of Service